Nuxeo Keycloak

The Nuxeo Keycloak package allows you to integrate Keycloak, an Open Source Identity and Access Management solution.

Nuxeo/Keycloak Automation and REST API Status Code Specifications

Here are the status codes to expect depending on the plugins' order in the Automation and RestAPI specific authentication chains.

Sample Contribution to Change the Authentication Plugins' Order, Overriding the Keycloak Package’s Contribution

Here is a sample contribution allowing to put Keycloak first in the Automation and RestAPI specific chains. This would allow you to get the same response status codes as in the second half of the above table.

<component name="org.nuxeo.ecm.platform.login.keycloak.descriptor.override">
    <require>org.nuxeo.ecm.platform.login.keycloak.descriptor</require>

    <extension
      target="org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService"
      point="specificChains">
        <specificAuthenticationChain name="RestAPI">
            <urlPatterns>
                <url>(.*)/api/v.*</url>
            </urlPatterns>
            <replacementChain>
                <plugin>KEYCLOAK_AUTH</plugin>
                <plugin>AUTOMATION_BASIC_AUTH</plugin>
            </replacementChain>
        </specificAuthenticationChain>
    </extension>

    <extension
      target="org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService"
      point="specificChains">
        <specificAuthenticationChain name="Automation">
            <urlPatterns>
                <url>(.*)/automation.*</url>
            </urlPatterns>
            <replacementChain>
                <plugin>KEYCLOAK_AUTH</plugin>
                <plugin>AUTOMATION_BASIC_AUTH</plugin>
            </replacementChain>
        </specificAuthenticationChain>
    </extension>

</component>